Static

static

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mshtml.zip

  • Size

    262KB

  • MD5

    75a28db68a020da28cf223010f7c9f9c

  • SHA1

    361aa10961eed91b277ffea70641ed6435550d7d

  • SHA256

    31475717735f9aee20def2a4044b42a52cb92e8cf885b92a042099a273688135

  • SHA512

    6fbe84b932773d0e0f7b12ddcbb4d2b6f802036f71f42f95b65bed7d3a262db3609bbbc4ee8c54a5ee86c5e952da059bba1fd99ac532c07401a3bf98068f3964

  • SSDEEP

    6144:dem485iuNrJhuJGd0AkfX+Yk3xonVBio57pMN+UM8iNuiYwLGZTqUdJP+TDu:dempTJAQd0AmOX3mVBp1MN5Ri/YeGZTl

Score
10/10

Malware Config

Extracted

Rule
Microsoft Office MHTML OLEObject
C2

arsenal.30cm.tw:1212/word.html

http://175.24.190.249/note.html

http://trendparlye.com/wiki0509.html

http://hidusi.com/e8c76295a5f9acb7/side.html

Signatures

Files

  • mshtml.zip
    .zip

    Password: infected

  • Challenge_FIles/Employee_W2_Form.docx
    .docx office2007
  • Challenge_FIles/Employees_Contact_Audit_Oct_2021.docx
    .docx office2007
  • Challenge_FIles/Work_From_Home_Survey.doc
    .docx .doc office2007
  • Challenge_FIles/income_tax_and_benefit_return_2021.docx
    .docx office2007
  • tools/numbers-to-string.py
    .py .sh linux
  • tools/oledump_V0_0_60.zip
    .zip
  • contains_pe_file.yara
  • decoder_add1.py
    .py .sh linux
  • decoder_ah.py
    .py .sh linux
  • decoder_chr.py
    .py .sh linux
  • decoder_rol1.py
    .py .sh linux
  • decoder_xor1.py
    .py .sh linux
  • maldoc.yara
  • oledump.py
    .py .sh linux
  • plugin_biff.py
    .py .sh linux
  • plugin_clsid.py
    .py .sh linux
  • plugin_dridex.py
    .py .sh linux
  • plugin_hifo.py
    .py .sh linux
  • plugin_http_heuristics.py
    .py .sh linux
  • plugin_jumplist.py
    .py .sh linux
  • plugin_linear.py
    .py .sh linux
  • plugin_msg.py
    .py .sh linux
  • plugin_msg_summary.py
    .py .sh linux
  • plugin_msi.py
    .py .sh linux
  • plugin_office_crypto.py
    .py .sh linux
  • plugin_ppt.py
    .py .sh linux
  • plugin_str_sub.py
    .py .sh linux
  • plugin_stream_o.py
    .py .sh linux
  • plugin_stream_sample.py
    .py .sh linux
  • plugin_vba.py
    .py .sh linux
  • plugin_vba_dco.py
    .py .sh linux
  • plugin_vba_routines.py
    .py .sh linux
  • plugin_vba_summary.py
    .py .sh linux
  • plugin_vbaproject.py
    .py .sh linux
  • plugin_version_vba.py
    .py .sh linux
  • vba.yara
  • tools/re-search.py
    .py .sh linux
  • tools/reextra.py
    .py .sh linux
  • tools/reextra.pyc
  • tools/xmldump.py
    .py .sh linux
  • tools/zipdump.py
    .py .sh linux